#35229 [NEW]: call_user_func() crashes when arguement_stack is nearly full

From: segv74 at gmail dot com Operating system: linux PHP version: 5CVS-2005-11-15 (snap) PHP Bug Type: Reproducible crash Bug description: call_user_func() crashes when arguement_stack is nearly full Description: ------------ call_user_func() can be creahed when argument_stack in executor_globals is nearly full and callback function is autoloaded after call_user_func() is called. in PHP_FUNCTION(call_user_func), it saves params from argument_stack, and calls zend_is_callable(). so, if zend_is_callable() calls __autoload() and __autoload() uses function calls heavily, argument_stack in executor_globals is realloced(zend_stack.c:173). in this case, saved params should be rewritten by newly alloced one. Reproduce code: --------------- === test.php === <? function __autoload($class) { include 'test1.php'; call_user_func(array('test1', 'use_stack'), 1,2,3,4,5,6,7,8,9,10, 11,12,13,14,15,16,17,18,19,20, 21,22,23,24,25,26,27,28,29,30, 31,32,33,34,35,36,37,38,39,40 ); } call_user_func(array('test1', 'use_stack'), 1,2,3,4,5,6,7,8,9,10, 11,12,13,14,15,16,17,18,19,20, 21,22,23,24,25,26,27,28,29,30, 31,32,33,34,35,36,37,38,39,40 ); == test1.php == <? class test1 { function use_stack($a1,$a2,$a3,$a4,$a5,$a6,$a7,$a8,$a9,$a10, $a11,$a12,$a13,$a14,$a15,$a16,$a17,$a18,$a19,$a20, $a21,$a22,$a23,$a24,$a25,$a26,$a27,$a28,$a29,$a30, $a31,$a32,$a33,$a34,$a35,$a36,$a37,$a38,$a39,$a40) { echo "OK\n"; } } Expected result: ---------------- OK Actual result: -------------- OK Segmentation fault (core dumped) -- Edit bug report at http://bugs.php.net/?id=35229&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=35229&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=35229&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=35229&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=35229&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=35229&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=35229&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=35229&r=needscript Try newer version: http://bugs.php.net/fix.php?id=35229&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=35229&r=support Expected behavior: http://bugs.php.net/fix.php?id=35229&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=35229&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=35229&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=35229&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=35229&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=35229&r=dst IIS Stability: http://bugs.php.net/fix.php?id=35229&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=35229&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=35229&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=35229&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=35229&r=mysqlcfg